RFP 6404 Attachment B Vendor Security Controls Questionnaire 2025.xlsx
XLSX spreadsheet 37 KB Posted
- Solicitation number
- RFP 6404
- Issued by
- Jefferson County, Lakewood City, Colorado
About this file
The document is a Vendor Security Controls Questionnaire (RFP 6404) from the City of Lakewood, Colorado, specifically designed to assess a potential vendor's information security capabilities for an Audio Visual Upgrade Services project in Public Safety Building Courtrooms. The questionnaire is comprehensive, requiring detailed responses across 11 distinct security control domains, including security audit results, policies and procedures, access control, vulnerability management, logging and monitoring, data backup and recovery, physical security, network security, cryptography, change management, and regulatory compliance.
The security questionnaire is structured to evaluate a vendor's information security posture through a series of detailed questions and requires supporting documentation for verification. Key areas of focus include ensuring the vendor has robust security policies, unique user authentication, vulnerability management processes, data protection strategies, physical and network security controls, and compliance with relevant standards such as PCI DSS, HIPAA, CJIS, and WCAG 2.0. The document mandates that vendors provide specific documentation like PCI Attestations, risk assessments, external audit results, and certifications to demonstrate their security readiness. Vendors are instructed to submit completed questionnaires and supporting documents to Yvette Florez at yflorez@lakewood.org, with an emphasis on providing detailed, specific responses to avoid delays in the security review process.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| RFP 6404 Attachment A Requirement Spreadsheet.xlsx | XLSX spreadsheet | |
| RFP 6404.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions
| Instructions: |
| 1. Complete all sections of the Security Controls Questionnaire tab and provide required supporting documentation. |
| 2. Submit completed Security Controls Questionnaire and attach all required supporting documentation to yflorez@lakewood.org |
If you have questions, please, consult Lakewood's ISSM, Yvette Florez yrflorez@lakewood.org
Security Controls Questionnaire Controls Questionnaire Status Vendor Name:
Date Sent to Vendor:
Date Received from Vendor:
Annual Review Date:
| In Place | Planned | Not in Place | ||
| 0 | Security audit results or attestations | |||
| If you store, process or transmit payment data, can you provide a certified PCI Attestation of Compliance or Self Assessment Questionnaire? | ||||
| If you store, process or transmit protected health information, can you provide your latest annual risk assessment or external audit results of your information security and privacy controls? | ||||
| If you store, process or transmit personally identifiable information, can you provide your latest annual risk assessment or external audit results of your information security and privacy controls? | ||||
| If you handle Criminal Justice Data, can you provide your CJIS certification? | ||||
| If you store, process or transmit financial accounting information, can you provide your latest SSAE-16 Type II external audit results? |
Note: To avoid any delays in the security review, please be specific and detailed with your answers. If you reference a document in any part of the answers, the document must be attached.
| 1 | Security Policies and Procedures |
| Ensure that a comprehensive set of information security policies exist to drive the development and implementation of the information security program as well as provide an auditable baseline. |
* Policies exist and are enforced
* Policies are kept up-to-date
* Policies dissemenated through security awareness training
* Does your organization have written security policy that addresses employee background checks?
Describe your enterprise information security policies and the role they play in your security program:
| 2 | Information Security Program |
| Ensure that a comprehensive information security program is in place to protect infrastructure and sensitive data assets. |
* Security roles exist and personnel are assigned accountability for execution of the security program
* Security ontrols are validated by external audit or trained internal audit staff on a recurring basis
* Information security risk analysis is performed on a recurring basis and drives improvements in the security policies, processes, and controls
* Incident response plan exists and is tested on a recurring basis Describe your enterprise information security program:
| 3 | Access Control |
| Ensure that access controls are in place to properly authenticate, authorize, and audit system activity. |
* All users are assigned a unique ID
* Authentication data is stored in a secure directory or database
* Password policies are enforced to enforce complexity requirements, limit reuse, and require regular updates Describe the access control policies, procedures, and systems in place at your organization. Include OS, application, and data access controls as appropriate:
| 4 | Vulnerability Management |
| Ensure that a robust system of vulnerability management is in place to protect critical infrastructure and data. |
* Patching policies and processes
* Anti-virus and malware prevention tools in place
* External and internal network vulnerability scans
* Recurring network and application penetration testing Describe your vulnerability management policies and procedures:
| 5 | Logging and Monitoring |
| Ensure that system activity is monitored and auditable. |
* Security logs are centralized and secured
* Logs are reviewed daily or appropriate event alerts are active
* Policies and procedures exist for the creation, maintenance, and usage of log information.
Describe your logging and security event management practices:
| 6 | Data Backup & Recovery |
| Ensure critical data is protected from loss or destruction. |
* Data is backed up on a regular basis
* Backups are stored off-site and are secured
* Data recovery plans are up-to-date and tested on a regular basis
* High availability solutions are in place where appropriate
* Data retention policies are in place and enforced on existing and archived data Describe your data protection practices:
| 7 | Physical Security |
| Physical facilities are secured. |
* Physical entry controls exist and are functioning for sensitive areas
* Locations containing sensitive data are monitored
* Visitors to sensitive areas must be authorized and escorted
* Documented processes exist to remove all sensitive information from equipment before disposal or re-use Describe the physical and environmental security controls in place at your facilities:
| 8 | Network Security |
| Ensure that network communications are secure and present minimal risk to information assets. |
* Firewalls are in place to protect the public facing network interfaces
* Sensitive or regulated data is protected within isolated network segments
* Firewalls deny all traffic by default with only documented traffic allowed
* IDS/IPS sensors are in place to detect and alert any unusual network traffic
* Publicly accessible network jacks require authentication in order to access sensitive data
* Wireless access points require authentication to access internal resources and do not use weak encryption methods Describe the network security controls in your environment:
| 9 | Cryptography |
| Cryptographic systems are properly configured and maintained. |
* Sensitive data is encrypted in transit and at rest
* Cryptographic keys and systems are secured and access is restricted
* Cryptographic keys are rotated on a recurring basis
* Weak crypto algorithms or implementations are not permitted or in use Describe your data encryption policies and procedures:
| 10 | Change Management & Development Life Cycle |
| Ensure that system changes are tested, documented, and authorized. |
* Documented change management policies and procedures exist and are followed
* System changes must be tested and authorized prior to deployment to production systems
* Software development efforts follow a documented software development lifecycle
* System changes must adhere to established security configuration guidelines
* Software development processes address OWASP vulnerabilities in coding practices and implementation
* Software meets Web Content Accessibility Guidelines (WCAG) 2.0 with AA level of conformance.
Describe your change management practices:
| 11 | Compliance & Regulatory |
| Ensure that all relevant legal, compliance, and regulatory statutes are addressed. |
* Systems that transmit, process, or store credit card information are PCI DSS compliant. - https://www.pcisecuritystandards.org/
* Systems that transmit, process, or store electronic personal health records conform to the requirements of the HIPAA Security Rule and the HITECH Act (see NIST SP 800-66)
* Organizations that do not fall under PCI or HIPAA requirements can provide a SSAE-16 (SOC Type II) or equivalent audit report
* Organizations that handle Criminal Justice data or provide systems that handle criminal justice data must be CJIS compliant -https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center
* Provide Accessibility Conformance Report / Voluntary Product Accessibilty Template (VPAT) Describe the audit assurances or certifications your organization is able to provide:
&F &P&N
File details come from the government source that posted it. Updated .